Code Snippets from GitHub Gists privacy

_Last updated 2026-11-05. Publisher Zovo._

What the app does with data

The app shows public GitHub gists inside Confluence pages.

Data sent outside Atlassian

Sent to	What	When
`api.github.com` (GitHub, Inc.)	The gist ID and, if one is pinned, the revision SHA. An `If-None-Match` value from GitHub's previous answer. Fixed headers (`User-Agent: forge-github-gists`).	When a page with the macro is viewed and the cached copy is older than 1 hour (24 hours for a pinned revision).
`api.github.com`	The GitHub token saved by a Confluence administrator, if any, as `Authorization: Bearer …`.	With the requests above, and when an administrator saves the token or opens the settings page (`GET /rate_limit`). If GitHub rejects the token, gist requests are sent without it for the next hour.

The app doesn't send page content, page titles, space names, user names, account IDs, email addresses or IP addresses of your users. Requests come from Atlassian's Forge platform, not from the reader's browser. GitHub's own privacy statement covers the requests GitHub receives.

Data stored in Forge storage (hosted by Atlassian)

The gist cache holds the public data of each gist shown. That is the owner's GitHub login, the description, file names, detected languages, file contents (at most 2 MB of text, less when it must be escaped for storage), the revision SHA and GitHub's ETag. Each entry is deleted automatically 24 hours after it was last fetched (48 hours for pinned revisions).

Short-lived markers hold only a time. A missing gist is remembered for 5 minutes, and a revision GitHub doesn't know for 1 hour. A rate-limit marker lasts until GitHub's reset time (at most 1 hour). A rejected-token marker lasts 1 hour and is set when GitHub rejects the saved token. It doesn't hold the token. None of these markers hold personal data.

The GitHub token is optional. A Confluence administrator saves it, and it's kept in Forge secret storage until an administrator removes it or the app is uninstalled. It's never shown in the UI or written to logs.

No Atlassian account IDs, names or other personal data of Confluence users are stored. A GitHub login is public information that the gist's owner published together with the gist.

Logs

Forge function logs record only error types, such as "storage read failed: Error". They never include gist content, tokens or user data.

Contact

The support contact will be added before the Marketplace submission.

Privacy policy for Code Snippets from GitHub Gists (for Confluence)

What the app does with data

Data sent outside Atlassian

Data stored in Forge storage (hosted by Atlassian)

Logs

Contact